Image extensions in BBCode

[ecopetition]

Hi there,

 

I'm trying to control what image extensions a user can put into an image BBCode, which works with preg_replace. Basically, I don't want them to put .php, .js, .html etc extensions into tags, so need it return an error when they try to do this. However, I do want them to put .png, .bmp, .gif, .jpg etc into the code.

 

Also, if I was to type the following:

[img=www.hotmail.com]

As well as:

[img=www.hotmail.com/image.php.gif]

How could I have this return an error also? (In other words, only if it contains a proper image extension at the end should it work).

 

Any advice as to how to go about this would be greatly appreciated.

 

Thanks a lot in advance,

Peter

[DarkWater]

Can I see your current img tag regex?

[ecopetition]

Right now it's a rather not-very-sophisticated:

$text = preg_replace('#\[img\](.+?)\[\/img\]#i', '<img src="$1" alt="" />', $text);

 

(please note that I updated the first post).

 

Thank you.

[DarkWater]

K, read the edit.  So basically:

 

$text = preg_replace('#\[img\]([^.]+\.(gif|jpeg|jpg|png))\[/img\]#', '<img src="$1" alt="" />', $text);

 

EDIT: Small typo; had the wrong quotation mark.

[wildteen88]

A long winded version:

$text = 'Hello World!

Good:
[img=http://www.google.co.uk/images/firefox/sprite.png]
Bad:
[img=http://www.google.co.uk/images/firefox/sprite.php]';

$text = preg_replace_callback('#\[img\](.+?)\[/img\]#s', 'parse_image', $text);

function parse_image($data)
{
    $trusted_ext = array('gif', 'jpg', 'jpeg', 'bmp', 'png');

    $info = pathinfo($data[1]);
    if(in_array($info['extension'], $trusted_ext))
    {
        return '<img src="'.$data[1].'" />';
    }

    // this could be just "return false;"
    return '<span style="color:red"><b>REMOVED</b></span>';
}

echo nl2br($text);

[ecopetition]

K, read the edit.  So basically:

 

$text = preg_replace('#\[img\]([^.]+\.(gif|jpeg|jpg|png))\[/img\]#', '<img src="$1" alt="" />', $text);

 

EDIT: Small typo; had the wrong quotation mark.

 

I tried this method in place of the original code but it doesn't work - BBCode does not function with it.

[DarkWater]

Worked for me. o_O

[ecopetition]

DarkWaters code only worked for me when the file was a local one, and did not contain a path to the file.

 

Any advice 

[DarkWater]

Oh, good point.  I see what happened.  Try:

 

$text = preg_replace('#\[img\](.+?\.(gif|jpeg|jpg|png))\[/img\]#', '<img src="$1" alt="" />', $text);